NetBSD-Users archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: conditional nat using ! negation

thank you,

I haven't tried it yet, because my original intention was to use NetBSD npf  instead of FreeBSD pf in a large environment (HPC datacenter),

this because apparently npf can take advantage of multi-core CPUs way better than PF on other *BSD systems.

I will test it and see if the negation effectively works.

Thanks a lot


On 6/1/24 1:24 PM, Martin Husemann wrote:
On Wed, May 29, 2024 at 11:33:28AM +0200, fddi wrote:
So for example, nat any clients from, to any
desination NOT matching, thus traffic to is
supposed to be routed and not natted.

$pub_if = "vioif0"
map $pub_if dynamic any -> inet4($pub_if) pass family inet4 from {, } to !

but this is what "npfctl validate" or "npfctl show" is showing:

map vioif0 dynamic any -> pass family inet4 from {, } to

The negation mark (!) is ignored
At quick glance it seems the generated bpf byte code is correct, but the
pretty printer used in "validate" and "show" misses the destination inversion
option (there is code that should show it, but it seems to be buggy).

You can see the difference between the version with and without the ! by
doing something like:

npfctl debug -c npf.conf > out.neg

then removing the ! and try again:

npfctl debug -c npf.conf > out.positive

and then diff -u the two out.* files.

Have you tried if your NAT works?

Please file a PR with the details, there defintively is a bug if
"show" or "validate" don't show a rule that could be used for input.


Home | Main Index | Thread Index | Old Index